Privacy Policy
1. Controller
The controller responsible for personal data processed on this website is:
- Company
- Urbanshop, LLC
- Legal form
- LLC
- Registered address
- c/o Legalinc Corporate Services Inc.
131 Continental Dr, Suite 305
Newark, DE 19713
US - Registration number
- 10768795 (Delaware) · EIN 37-2250520
- VAT number
- Not VAT registered
- [email protected]
For every privacy question or request write to [email protected]. We have not appointed a data protection officer because we are not legally required to; the address above reaches the person responsible for data protection.
2. What we process, why, and on which legal basis
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Name, email, phone, billing address, booking details, payment status | Taking and managing bookings, sending confirmations, refunds, support | Art. 6(1)(b) contract | 10 years for accounting records, otherwise 3 years after the last booking |
| Account data (email, password hash, name) | Providing your account | Art. 6(1)(b) contract | Until you delete the account; unused unverified accounts after 30 days |
| Guide applications: identity, ID document, licence, bio, photo, payout details | Verifying guides, publishing profiles, paying guides | Art. 6(1)(b) contract, Art. 6(1)(c) legal obligation | ID documents of rejected applicants are deleted after 90 days; approved guides: duration of the contract plus statutory periods |
| Guide tax data: legal name, address, tax ID (TIN), date of birth, VAT number, bank account | Invoices and annual reporting to tax authorities under Council Directive (EU) 2021/514 (DAC7) | Art. 6(1)(c) legal obligation | 10 years after the end of the reporting year |
| Reviews, problem reports, messages to guides and support | Quality, dispute handling, safety of the platform | Art. 6(1)(b) and (f) legitimate interest | 3 years after the case is closed |
| Reports of illegal content (reason, details, your email) | Handling notices under the Digital Services Act | Art. 6(1)(c) legal obligation | 3 years |
| Consent records (time, version, choices, hashed IP address) | Proving consent (Art. 7(1) GDPR) | Art. 6(1)(c) legal obligation | 3 years after withdrawal or expiry |
| Server logs (IP address, time, page, browser) | Security and error analysis | Art. 6(1)(f) legitimate interest | 90 days |
| Marketing attribution (which ad or site brought you here) | Measuring our marketing | Art. 6(1)(a) consent; § 25 TTDSG / Art. 5(3) ePrivacy Directive | Until you withdraw consent, at most 6 months |
3. Who receives your data
- The guide of your tour receives your name, email, number of participants and any message you send, to run the tour. Guides are independent controllers and may use the data only for your tour.
- Payment providers process payment data as independent controllers under their own privacy policies.
- Hosting, email delivery and IT service providers process data on our behalf under data processing agreements (Art. 28 GDPR).
- Tax authorities receive guide data under DAC7 and accounting data when legally required. Courts, police and authorities receive data only when we are legally obliged.
Where a service provider is located outside the EU/EEA, we transfer data only on the basis of an adequacy decision (for example the EU-US Data Privacy Framework) or EU standard contractual clauses (Art. 46 GDPR).
4. Cookies and similar technologies
We use only necessary cookies unless you agree to more in the cookie banner. Details and your settings: Cookie Policy. Fonts are served from our own server; we do not send your IP address to font services.
5. Your rights
- Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20).
- Objection (Art. 21): you can object at any time to processing based on legitimate interests, on grounds relating to your particular situation, and to direct marketing without giving reasons.
- Withdrawal of consent (Art. 7(3)) with effect for the future, for cookies via "Cookie settings" in the footer.
- Signed-in users can download their data or request deletion under My Account → Privacy & data (guides: Guide dashboard → Profile). We confirm the request by email and complete it within one month.
- Complaint to a supervisory authority, in particular in the EU country where you live or work. Our lead authority: the data protection supervisory authority in the EU or EEA country where you live, work or think your rights were infringed.
We keep booking amounts, dates and invoice records even after an erasure request for as long as tax and commercial law require; the rest is deleted or anonymised.
6. Security and automated decisions
The site uses TLS encryption. Identity documents are stored in a non-public area that only authorised staff can open. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.
7. Changes
We update this policy when our processing changes. The version number and date at the top show the current version.